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Abstract 

We report here a complete experimental realization of one-way decoy-pulse quantum key distri- 
bution, demonstrating an unconditionally secure key rate of 5.51 kbps for a 25.3 km fibre length. 
This is two orders of magnitudes higher than the value that can be obtained with a non-decoy 
system. We introduce also a simple test for detecting the photon number splitting attack and 
highlight that it is essential for the security of the technique to fully characterize the source and 
detectors used. 

PACS numbers: 03.67.Dd Quantum Cryptograpliy 
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Communication with single photons promises for the first time a method to exchange dig- 
ital keys between two remote parties (referred to as Alice and Boh)^^ the secrecy of which 
are not reliant upon assumptions about an eavesdropper's surveillance equipment, comput- 
ing power or guile.i^ Currently, however, the security of quantum key distribution (QKD) is 
compromised by the multi-photon pulses inevitably produced by the attenuated lasers used 
in today's systems.— In the photon number splitting (PNS) attack, an eavesdropper (Eve) 
preferentially transmits these multi-photon pulses to Bob through a lossless channel after 
removing part for measurement, while blocking a correponding number of single photon 
pulses to maintain the same detection rate at Bob.— By doing so, she can determine part, 
or all, of the key while remaining hidden. 

Recently it has been proposed that the PNS attack may be foiled using decoy pulses, with 
a different average intensity from the signal pulses.— ^i^iiiii^ By determining the transmission 
of the signal and decoy pulses separately, Alice and Bob are able to detect PNS attacks. 
An early experimenlF^ has already demonstrated the feasibility of the decoy pulse protocol, 
although using a send-and-return architecture for which Alice does not have full control of 
the individual pulse intensities, as required for its secure implementation. We report here 
a complete experimental demonstration of one-way decoy pulse QKD over 25.3 km fibre 
with a continuous key rate of 5.51 kbps, which is unconditionally secure against all types of 
attacks, including PNS. 

Decoy pulse QKD theory gives a rigorous bound of the characteristics of the single photon 
pulses, which are the only source pulses that contribute to the secure bit rate.-^^^ In the 
simplest decoy protocol,— two different average pulse intensities (referred to as signal and 
decoy pulses) with mean photon numbers of fi and u > u) respectively are used. By 
measuring the transmittances and Qy, i.e., Bob's detection probability of a signal or 
decoy pulse respectively, the lower bound (Qf ) of the single photon transmittance, which is 
defined as the joint probability that a signal pulse contains only one photon and the pulse 
is detected by Bob, can be written as^>^^ 

Q\ = J^-^(Qy - Q^e^^ - e,Q,e^^^-^) (1) 

where is the bit error rate of the signal pulses, and is the lower bound of the decoy 
pulse transmittance, estimated conservatively as 10 standard deviations of Qi, from the 
measurement value, ensuring a confidence interval of 1 — 1.5 x 10~^^. By assuming all bit 
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errors are from single photon pulses, the upper bound, , for the bit error rate of the single 
photon pulses can be bounded as 



e'^ = -^ (2) 



With the bounds Qf and available, the secure bit rate is readily calculated, which will 
be shown later. 

We use a one-way fibre-optic QKD system with phase encoding, schematically shown in 
Fig. 1. It uses two asymmetric Mach-Zender interferometers for encoding and decoding. 
The sending (Alice) and receiving (Bob) units are connected with a 25.3 km fibre spool. 
Both the signal and decoy pulses are generated by a 1.55 fim pulsed laser diode of fixed 
intensity operating at 7.143 MHz. The pulses are modulated with an intensity modulator 
to produce the desired ratio of signal pulse strength to decoy pulse strength, and are then 
strongly attenuated to the desired level by an attenuator before leaving Alice's apparatus. 
Synchronization is realized by multiplexing a 1.3 fim clock signal with the quantum signals so 
that clock and quantum signals can be sent through the same fibre. An active stabilization 
technique^^ is used to ensure continuous operation. 

Two single photon detectors based on InGaAs avalanche photodiodes are carefully pre- 
pared for the experiment. Care was taken to minimize detector afterpulsing,— which cor- 
relates photon detection events of the signal and decoy pulses and prevents faithful mea- 
surements of Qfj_ and Q„. The system detection efficiency, including channel transmission 
loss (4.7 dB) and Bob's loss (2.5 dB), was characterized at 1.95 x 10~^. The sum of the 
dark count rates for the two detectors was 9.4 x 10~^ per pulse. Custom electronics were 
developed for driving the QKD optics. 

We implemented the one weak decoy state + BB84 protocoli^ in our experiment. The 
decoy pulse probability is chosen to be 1/4. Each QKD session is set to be 1 x 10^ sifted 
bits, including both signal and decoy pulses, corresponding to approximately 2 x 10^ photon 
detection events. The signal and decoy pulse intensities are chosen as /i = 0.425 and u = 
0.204 to provide optimum secure bit rate. 

We recorded the output from the decoy QKD experiment continuously for four hours, 
during which a total of 372 QKD sessions were executed, each lasting 38.7 s on average. 
The measured bit error rates (6^,6^) for signal and decoy states, as shown in Fig. 2(a), 
are stable at 1.72% and 2.74% respectively. These values are consistent with the measured 
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interferometer visibility, mis-compensation, and detector dark counts. Transmittances 
and Qp, shown in Fig. 2(b), fluctuate in tandem, and such fluctuation is attributed mainly 
to variation of the channel transmission and the detection efficiency. The sharp dips in 
and are due to polarization or phase resets of the active alignment system, during 
which photons were temporarily not counted. Figure 2(c) shows the measured ratio of 
QiilQv, which remains virtually constant despite the larger fluctuations in and Qy. The 
measured ratio is remarkably consistent with the theoretically expected (red line), indicating 
the system has produced and detected both signal and decoy pulses reliably. 

The final secure bit rate, i?, was obtained, after estimating Q\ and using Eqns. (1) 
and (2), by first applying a modified Cascadei^ error correction routine, followed by privacy 
amplification,— using 

R > {-N';f'UM2{e,) + iVf - H,{e^,)]}/t (3) 

where A*"^*-^* is the number of the sifted bits from the signal pulses, N^^^* = ^Qft the lower 
bound of the number of the sifted bits for the single photon pulses, and t is the QKD session 
time. H2{e) = — £:log2(£:) — (1 —5) log2(l — e) is the binary Shannon entropy, fee is the error 
correction efficiency relative to Shannon limit. Our error correction module gives fee ~ 1-10 
for the given bit error rate. 

As shown in Fig. |2l the secure bit rate remains fairly stable and positive for all decoy 
sessions, with an average value of 5.51 kbps. The rate is much higher than a non-decoy 
QKD system. For a non-decoy system using the same detectors, we found the maximum 
fibre length secure from the PNS attack to be just 9 km. With quieter detectors, a secure 
bit rate of 43 bps was previously achieved for 25 km of fiber.— Thus, our implementation 
of the decoy protocol has allowed more than two orders of magnitude enhancement in the 
secure bit rate. 

To detect the PNS and related attacks, Alice and Bob can monitor the ratio Qu/Qfi- 
In the current experiment, we expected a ratio of Q^/Qfi = ^^^y° = 0.486, where rj is the 
system detection efficiency and Yq is the dark count rate. Significant deviation of the mea- 
sured ratio from this expected value indicates a PNS by Eve. In the PNS attack. Eve first 
counts the number of photons in each pulse using a quantum non-demolition measurement 
and preferentially transmits the multiphoton pulses to Bob. Since the signal pulses are 
stronger than the decoy pulses, and thus contain more multi-photon pulses, the PNS will 
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tend to reduce QvlQn- Figure El shows a simulation, together with the experimental points, 
of the secure bit rate dependence on the ratio QvlQyi- The experimental data is in excellent 
agreement with theory when the PNS is not present. With the PNS attack present, the sim- 
ulated secure bit rate decreases rapidly with the ratio Qu/Q^i- No secure bit rate is possible 
when the ratio is merely 17% smaller than expected, highlighting the privacy amplification 
cost to remove information leaked by the PNS attack. Such a sensitive dependence puts 
stringent requirements on the preparation and measurement of the signal and decoy pulses. 
The measured ratio may be slightly higher than expected due to statistical uncertainty, or 
if Eve chooses to preferentially transmit the single photon pulses. A more likely case of the 
measured ratio exceeding the expected value is due to artifacts, such as mis-calibration of 
signal and decoy intensity ratio and/or detector afterpulsing. Such artifacts would cause 
an over-estimation of secure bit rate, thereby compromising security, and must therefore be 
carefully eliminated. This has been achieved in our experiment by careful calibration of the 
source and detectors. 

Secure bit rate is dependent on the session duration due to the statistical certainty with 
which and can be estimated. Longer sessions allow a more precise determinate and 
a higher bit rate. It can be seen in Fig. |S1 that the calculated secure bit rate increases with 
session duration, approaching the maximum value for sessions exceeding 1000 seconds. Due 
to statistical fiuctuations, there is a minimum session time for establishing a secure bit rate, 
found here to be around 0.4 s. We perform decoy protocol QKD at three distinct session 
times: 9.2, 18.5, and 38.7 s, and results are shown also in Fig. El Even with the shortest 
time of 9.2 s, a secure bit rate of 4.80 kbps is achieved, which is about 78% of the saturation 
rate with infinite session time, demonstrating that long session times are not necessary for 
decoy pulse QKD. 

In summary, a practical one-way decoy QKD system has been demonstrated over a 
25.3 km fiber with an average bit rate of 5.51 kbps. It is unconditionally secure against 
all types of attacks, including the PNS attack. We conclude that decoy pulses improve 
the security and performance of weak pulse QKD. However, sources and detectors must be 
calibrated accurately to avoid any artifacts that may compromise security. 

During preparation of this manuscript two other implementations of decoy pulse QKD 
have appeared . ^^1^^ These show operation over longer fibre spools but with much lower key 
generation rates and are limited to local synchronization. 
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FIG. 1: Schematics of optical layout of the one-way decoy quantum key distribution system using 
BB84 phase-encoding; Attn: Attenuator; IM: intensity modulator; LDl: signal laser diode at 
1.55/im; LD2: clock laser diode at \.2>^m\ PC: polarisation controller; WDM: wavelength division 
multiplexer; DO, Dl: single photon detectors. 
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FIG. 2: Experimental results of a continuous series of decoy-QKD sessions for four hours, (a) 
Bit error rates measured for the signal and decoy pulses; (b) The measured transmittances for 
the signal pulses (Q^) and decoy pulses (Qu)', (c) The measured ratio Q^/Qu (empty squares) in 
comparison with the expected value (line). 
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FIG. 4: Simulated (solid line) and experimental (symbols) secure bit rate dependence on the 
transmittance ratio QyjQ^. The vertical dotted line indicates the expected ratio. 
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FIG. 5: Simulated (solid line) and experimental (symbols) secure bit rate as a function of QKD 
session duration. The dotted line shows the saturation secure bit rate with infinite QKD sesssion 
time. 
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